{"version":"2.1.305","anchor":"managed-mcp-allowlist-doc-var-rule-narrowed","canonical_anchor":"managed-mcp-allowlist-doc-var-rule-narrowed","heading":"allowedMcpServers description narrows which managed entries are exempt","tier":"notice","area":"MCP","scope":"org","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.305\/e\/managed-mcp-allowlist-doc-var-rule-narrowed","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.305","markdown":"### `allowedMcpServers` description narrows which managed entries are exempt\n\nThe `allowedMcpServers` setting now says managed-mcp.json entries are exempt unless ${VAR} appears in their command, args, url or header values\n\n**Unclear.** Whether the allowlist is now enforced differently, or only its description changed, is not clear.\n\n**What**\n\n`allowedMcpServers` is the setting administrators use to allowlist which MCP servers (add-on tool servers) users can add. Its description now says that entries in `managed-mcp.json` are exempt unless `${VAR}` appears in their command, args, url or header values. It used to say entries were exempt if they used no `${VAR}` expansion at all.\n\n**Why**\n\nThis makes clearer for administrators exactly which managed entries the allowlist covers: only where a variable appears in those four places.\n\n- Area: MCP\n- Names: `allowedMcpServers`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: org\n- Heads-up: yes"}